CVE-2022-31573: Path Traversal in chainerrl-visualizer
Summary
CVE-2022-31573: ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function. Affects chainerrl-visualizer versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chainerrl-visualizer is a Python package available on PyPI that provides a visualizer for the ChainerRL reinforcement learning library. It allows users to visualize and analyze the training process of reinforcement learning agents. The package includes a web server component built with Flask, which serves the visualizations to the user. However, a vulnerability has been identified in versions up to 0.1.1 of chainerrl-visualizer, which allows for path traversal attacks.
Vulnerability Detail
The vulnerability in chainerrl-visualizer arises from the unsafe use of the Flask send_file function. This function is used to serve image files to the user, but it does not properly validate the requested file path. As a result, an attacker can exploit this vulnerability by crafting a malicious request that includes a relative or absolute path traversal sequence. This allows the attacker to access arbitrary files on the server's file system, potentially exposing sensitive information or executing malicious code. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround can be implemented by modifying the affected function in the code. The vulnerable function is chainerrl_visualizer.web_server.create_app.get_image. To mitigate the path traversal vulnerability, the function should be updated to validate the requested file path and ensure that it only serves files from the intended directory. Here is an example of a possible fix:
import os
from flask import send_file
def get_image(filename):
# Validate the requested file path
if not filename.startswith('images/'): # Only serve files from the 'images' directory
return 'Invalid file path', 400
# Construct the absolute file path
file_path = os.path.join(app.static_folder, filename)
# Serve the file using Flask's send_file function
return send_file(file_path)
Conclusion
In conclusion, the chainerrl-visualizer package up to version 0.1.1 is vulnerable to a path traversal attack due to the unsafe use of the Flask send_file function. Users are advised to upgrade to version 0.1.2 or later to mitigate this vulnerability. Alternatively, the provided workaround can be applied to temporarily address the issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for chainerrl-visualizer →
FAQ
chainerrl-visualizer is a Python package that provides a visualizer for the ChainerRL reinforcement learning library. It allows users to analyze and visualize the training process of reinforcement learning agents.
This vulnerability allows an attacker to perform path traversal attacks, potentially accessing arbitrary files on the server's file system. This can lead to unauthorized access to sensitive information or the execution of malicious code.
To fix this vulnerability, it is recommended to upgrade to version 0.1.2 or later of chainerrl-visualizer. Alternatively, you can apply the provided workaround by modifying the get_image function to validate the requested file path.
Yes, the CVSS score for this vulnerability is 9.3, indicating a critical severity level.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-687h-86vc-5x59 or the CVE identifier CVE-2022-31573.
